AdvProp [1]} is a method based on adversarial training where the objective consists of a mixture of clean and adversarial examples for which separate BatchNorm layers are used, and only the clean BatchNorm layers are used at test time. This method was shown to improve the accuracy on clean images compared to standard adversarial training and to help to generalize under distribution shifts such as common corruptions, so we consider it here in more detail.
As shown in Table REF , AdvProp achieves 94.7% standard accuracy and \(82.9\%\)  common corruption accuracy. Thus AdvProp performs comparably to 100% \(\operatorname{\mathbf {\ell }}_\infty \)  adversarial training (\(82.9\%\)  vs \(82.7\%\)  accuracy on CIFAR-10-C), however, AdvProp still performs worse than 100% \(\operatorname{\mathbf {\ell }}_2\)  adversarial training (\(83.4\%\) ) and 100% RLAT (\(84.1\%\) ).
<FIGURE>